Skip to main content

​
📘 Documentation: Log Retention Policy (ILM)

Purpose: Automatically delete demo-app-logs-* indices once they reach 15 days of age to manage disk space. Log Source: Fluent Bit (sending daily dated indices).

​
1. The ILM Policy (demo_app_logs_retention_policy)

This policy defines the “rules” for the data. Since the logs are already rotated daily by Fluent Bit, we use a simple Delete-only phase.
  • Hot Phase: Active; no actions (keeps logs searchable).
  • Delete Phase: Triggers when the index age is > 15 days.
PUT _ilm/policy/demo_app_logs_retention_policy
{
  "policy": {
    "phases": {
      "hot": {
        "min_age": "0ms",
        "actions": {}
      },
      "delete": {
        "min_age": "15d",
        "actions": {
          "delete": {
            "delete_searchable_snapshot": false
          }
        }
      }
    }
  }
}

​
2. The Index Template (demo_app_logs_template)

This is the “glue” that ensures every new index created by Fluent Bit automatically follows the retention policy.
  • Index Pattern: demo-app-logs-*
  • Settings: Links the index to the policy name.
PUT _index_template/demo_app_logs_template
{
  "index_patterns": ["demo-app-logs-*"],
  "template": {
    "settings": {
      "index.lifecycle.name": "demo_app_logs_retention_policy"
    }
  }
}

​
3. Application to Existing Indices

New policies only apply to indices created after the template is made. To manage existing “unmanaged” indices, the policy must be attached manually: 
PUT demo-app-logs-*/_settings
{
  "index": {
    "lifecycle.name": "demo_app_logs_retention_policy"
  }
}

​
🛠 Troubleshooting & Maintenance

​
How to check status

To see if the “Janitor” (ILM) is currently processing or deleting indices: 
GET demo-app-logs-*/_ilm/explain

​
Common States

StepMeaning
hotThe index is younger than 15 days; it is safe and searchable.
deleteThe index has hit 15 days; it has entered the deletion queue.
wait-for-shard-history-leasesThe final safety check before the files are wiped from the disk.

​
Key Takeaways for Future Ref

  • No Rollover: Do not use rollover in the policy if your logs already have dates in their names (e.g., logs-2026.03.05). Using both causes alias errors.
  • No Aliases: In this simplified setup, aliases are not required, making the system much harder to break.
  • 10-Minute Poll: ILM checks for deletions every 10 minutes by default. Changes are not always instant.